5ff44c4023937a70bcc731375849e05ebd67a3d074fa73691e796b7fcfceaceb

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 10.3MB
Sample260801-dwb8jswhnb
SHA256 5ff44c4023937a70bcc731375849e05ebd67a3d074fa73691e796b7fcfceaceb
MD5 52424451f99c870c91ff84b5a68602fa
SHA1 3140b3148b1b1f5bfa02efc917daa45cfc44f4f9
SHA512 d3dbc52caa3e608b6f8700b640dda4ba4ef0cb96c9384a80acb629e0dd2ff5c6b9fc3bebe8d578ae237261c750d01787a80aab2d4881dafd2c030a7aa37664a6
SSDEEP 98304:hujiJKan47y1BqTQHoK1FrcjypUVVMlBwoN9E:hoKNmQqTQHvHojyKoNu
TLSH
T10FB63A43F8A145E9C1EED13485669262BB71BC454B3123DB2BA0F7282F73BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1872	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 4824 wrote to memory of 5232	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 4824 wrote to memory of 1528	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4824 wrote to memory of 5472	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 4824 wrote to memory of 4776	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 4824 wrote to memory of 2940	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 4824 wrote to memory of 252	4824	2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	101

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-01_52424451f99c870c91ff84b5a68602fa_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  2⤵
  - Views/modifies file attributes
  PID:1872
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentMinorVersionNumber
  2⤵
  PID:5232
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentMajorVersionNumber
  2⤵
  PID:1528
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CSDVersion
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseID
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
  2⤵
  PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads